The vulnerability in Authlib's OAuth 2.0 authorization server arises because the method get_authorization_grant() raises an UnsupportedResponseTypeError containing the raw redirect_uri from the request before any client lookup or redirect URI validation occurs. The OAuth2Error handler then automatically issues a 302 redirect to this attacker-controlled URI. This allows an unauthenticated attacker to exploit the authorization endpoint as an open redirect by sending a request with an unsupported response_type and a malicious redirect_uri. The issue was confirmed in version 1.6.6 and reproduced on the current HEAD at the time of reporting. The vulnerability is reachable through normal OAuth2 authorization flows in Flask and Django integrations using Authlib.

An attacker can cause the authorization endpoint to redirect users to arbitrary URLs without authentication or client validation. This open redirect can facilitate phishing attacks or redirect users to malicious sites, potentially undermining user trust and security. There is no direct compromise of user credentials or tokens from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, applications should carefully validate and restrict redirect_uri parameters and avoid relying solely on Authlib's default error handling for unsupported response types. Monitoring Authlib's official channels for patches addressing CVE-2026-41479 is recommended.